Intro
Frame buster are great little helpers that make sure hat an applications view can't be framed. There most times a very simple check if self is type equal with top. If this is not the case top.location will be set to self.location. Pretty easy. But what possibilities are there to circumvent this technique?
top!==self?top.location.href=self.location.href:false;
Some code
The only browser that is really easy to trick into executing code disabling frame busters is Chrome - latest release. Since Webkit supports the magic setter methods like __defineSetter__ it's possible to overwrite the location.href setter. Firefox doesn't allow that anymore - but gets tame with the help of event handlers. At least the page can't be left unless the user has confirmed that action at least twice.
<html>
<head>
<script>
try {
location.__defineSetter__('href', function() {return false});
} catch(e) {
justFalse = function() {
return false;
}
onbeforeunload = justFalse;
onunload = location.href = location.href;
}
</script>
</head>
<body>
<iframe src="framed.html"></iframe>
</body>
</html>
Conclusion
IE and Opera have done their job - and this technique can not be used to disable frame busters on framed sites. Thanks to the recently created FUD wave these topics have been resurrected and become interesting again. Reminds of AJAX and JavaScript.
Posts
No comments:
Post a Comment